Stream: git-wasmtime

Topic: wasmtime / issue #15010 RUSTSEC-2026-0406: Use-after-free...

Wasmtime GitHub notifications bot (Oct 27 2026 at 00:13):

github-actions[bot] opened issue #15010:

Use-after-free when changing a multithreaded context with an unfinished frame

Details
Status	unsound
Package	zstd-safe
Version	5.0.2+zstd.1.5.2
URL	https://github.com/gyscos/zstd-rs/commit/e224018a2389915d68ed17f30109bebad36e9734
Date	2026-10-16

When a multithreaded frame (zstdmt feature, CParameter::NbWorkers) is
left unfinished, its jobs may still be running on the worker threads: the C
library only waits for them when the next frame starts, or when the context
is freed. A session reset makes the context accept changes again in the
meantime, so:

• unloading the dictionary (load_dictionary, ref_cdict, ref_prefix,
  disable_dictionary, init*, or reset with parameters) freed the
  dictionary a worker was still compressing against;

• changing NbWorkers made the next frame resize the job table before
  waiting for the old jobs.

The flaw was corrected by refusing these calls while a multithreaded frame
is unfinished. The new CCtx::wait_for_workers() waits for the workers
first.

See advisory page for additional details.

Wasmtime GitHub notifications bot (Oct 27 2026 at 00:39):

pchickey closed issue #15010:

Use-after-free when changing a multithreaded context with an unfinished frame

Details
Status	unsound
Package	zstd-safe
Version	5.0.2+zstd.1.5.2
URL	https://github.com/gyscos/zstd-rs/commit/e224018a2389915d68ed17f30109bebad36e9734
Date	2026-10-16

When a multithreaded frame (zstdmt feature, CParameter::NbWorkers) is
left unfinished, its jobs may still be running on the worker threads: the C
library only waits for them when the next frame starts, or when the context
is freed. A session reset makes the context accept changes again in the
meantime, so:

• unloading the dictionary (load_dictionary, ref_cdict, ref_prefix,
  disable_dictionary, init*, or reset with parameters) freed the
  dictionary a worker was still compressing against;

• changing NbWorkers made the next frame resize the job table before
  waiting for the old jobs.

The flaw was corrected by refusing these calls while a multithreaded frame
is unfinished. The new CCtx::wait_for_workers() waits for the workers
first.

See advisory page for additional details.

Last updated: Oct 31 2026 at 23:03 UTC